You receive an email from someone you know saying they’ve shared a document with you through OneDrive or SharePoint. It looks legitimate, and you recognize the sender’s name. Safe to click, right?
Not necessarily.
Unexpected shared file links are a common phishing tactic used to compromise Microsoft 365 accounts. Cybercriminals can gain access to someone’s email account and use it to send malicious links to their contacts. Because the message comes from a familiar email address, it’s easy to assume it’s safe.
How to spot a suspicious shared file link
Before clicking a shared document link, ask yourself:
- Were you expecting it? If someone told you they were sending a file, that’s a good sign, but not a guarantee. Be cautious with unexpected documents.
- Is there a sense of urgency? Messages telling you to review a document immediately or take action before a deadline can be red flags.
- Does the link look legitimate? Hovering over a link may help you identify a suspicious destination, although some email security tools rewrite links, making this harder to determine.
What should you do if you’re unsure?
Call the sender directly using a phone number you already trust. Don’t simply reply to the email asking whether it’s legitimate. If their mailbox has been compromised, the attacker may be able to respond.
And if you’ve already clicked the link and it asks you to enter your Microsoft 365 username and password, stop. Don’t enter your credentials. Contact your IT team and let them know what happened.
If you’ve already entered your credentials, notify IT immediately so they can help secure your account.
The bottom line
A familiar sender doesn’t always mean a safe email. When an unexpected file-sharing link lands in your inbox, take a moment to verify it before clicking.
A quick phone call could prevent a compromised account and a much bigger cybersecurity headache.
